Artificial intelligence fraud management solution

ABSTRACT

An artificial intelligence fraud management solution comprises an expert programmer development system to build trainable general payment fraud models that integrate several artificial intelligence classifiers like neural networks, case based reasoning, decision trees, genetic algorithms, fuzzy logic, and rules and constraints. These are further integrated by the expert programmers and development system with smart agents and associated real-time profiling, recursive profiles, and long-term profiles. The trainable general payment fraud models are trained with supervised and unsupervised data to produce an applied payment fraud model. This then is applied by a commercial client to process real-time transactions and authorization requests for fraud scores.

RELATED APPLICATIONS

The current patent application is a continuation of and claims prioritybenefit to earlier-filed, identically-titled, co-pending non-provisionalpatent application Ser. No. 16/168,566, filed Oct. 23, 2018, which is acontinuation of non-provisional patent application Ser. No. 14/514,381,filed Oct. 15, 2014, which is a continuation-in-part of and claimspriority benefit to earlier-filed non-provisional patent applicationSer. No. 14/454,749, entitled HEALTHCARE FRAUD PREEMPTION, filed Aug. 8,2014 (now issued U.S. Pat. No. 9,779,407), and the entirety of each ofthe foregoing is hereby incorporated by reference into the currentapplication.

BACKGROUND OF THE INVENTION Field of the Invention

The present invention relates to automation tools for the applicationdevelopment of fraud management systems, and more particularly tomulti-discipline artificial intelligence machines for real-time use onbig data.

Background

Anyone impressed by the increasing and stunning speeds of computers, orstunned by their unfailing memory capacity, will not be able to find anymanifestations of intelligence as long as everything remains purelyalgorithmic.

Algorithmic programs are deductive ensembles of successive operationsapplied in a fixed order. An algorithm brings the computer to repeat,tirelessly and accurately, long suites of logical operations. However,such programs will neither know how to take any initiative, nor will anyever stray away from a fixed line of march.

Algorithmic programmers must always be able to dictate the precisesuccession of steps that the target machine is to follow. But, can youcannot ask any expert to predict all of the risk events that may befalla company or business in the next day, month, or year. And so it is forevery field that requires the use of experts.

Since every algorithm requires an exhaustive enumeration the vastmajority of industrial problems will be excluded from computer science.Industrial problems in which the resolution requires a minimum ofreasoning cannot be transcribed into an algorithmic form. This is alsotrue for programs based on artificial intelligence, like expert systemsand conventional object oriented languages. In the case of expertsystems, all the possibilities must be predicted in order to write allthe possible rules. Such is obviously impossible. In conventional objectoriented languages, all possible methods must be forecast, known andprogrammed for.

In the case of business, decisions integrate and often concern animportant number of variables that dynamically come and go.

What is needed is a technology that goes beyond algorithmic techniques,ones that know how to resolve very complex problems without needing tobe instructed on how to resolve them.

SUMMARY OF THE INVENTION

Briefly, an artificial intelligence fraud management solution embodimentof the present invention comprises an expert programmer developmentsystem to build trainable general payment fraud models that integrateseveral artificial intelligence classifiers like neural networks, casebased reasoning, decision trees, genetic algorithms, fuzzy logic, andrules and constraints. These are further integrated by the expertprogrammers and development system with smart agents and associatedreal-time profiling, recursive profiles, and long-term profiles. Thetrainable general payment fraud models are trained with supervised andunsupervised data to produce an applied payment fraud model. This thenis applied by a commercial client to process real-time transactions andauthorization requests for fraud scores.

Thus, an application development system is provided that is computerimplemented, artificial intelligence based, and machine learning based.The system includes: means for building trainable general payment fraudmodels that integrate several different classification models; means forincluding an initial set of run-time smart agents, neural networks,case-based reasoning, decision trees, and business rules in saidtrainable general payment fraud models; means for enabling saidtrainable general payment fraud models to be trained with historicaltransaction data; means for subsequently generating from said historicaltransaction data an initial population of smart agents and associatedprofiles and including them in said trainable general payment fraudmodels; means for subsequently generating from said historicaltransaction data an initial set of neural networks with a beginningweight matrix and including them in said trainable general payment fraudmodels; means for subsequently structuring from said historicaltransaction data an initial case-based reasoning set and an initial setof business rules and including them in said trainable general paymentfraud models; and means for subsequently detaching said trainablegeneral payment fraud models and for using them on a target applicationsystem, wherein, trainable general payment fraud models can be sold asproducts to customers to use on their computer systems to controlpayment fraud.

In some instances, the trainable general payment fraud models furthercomprise means for embedding an incremental learning technology andsmart-agent technology able to continually re-train artificialintelligence classifiers. The incremental learning technology mayfurther comprises: means for incrementally changing any initial decisiontrees by creating new links or updating existing links and weights;means for run-time updating of a weighting matrix of any initial neuralnetwork; any initial case-based reasoning logic to update its genericcases or create new ones; and/or means for self-updating said initialpopulation of smart-agents profiles and for creating exceptions toadjust their normal/abnormal thresholds.

The detachable and trainable general payment fraud models may furthercomprise: means for producing an independent and separate vote or fraudscore from each of said classification models, population of smartagents, and profilers; means for weighting and summing together eachsaid independent and separate vote or fraud score; and means foroutputting a final fraud score.

The above and still further objects, features, and advantages of thepresent invention will become apparent upon consideration of thefollowing detailed description of specific embodiments thereof,especially when taken in conjunction with the accompanying drawings.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is functional block diagram of an artificial intelligence fraudmanagement solution embodiment of the present invention;

FIG. 2A is functional block diagram of an application development system(ADS) embodiment of the present invention for fraud-based targetapplications;

FIG. 2B is functional block diagram of an improved and updatedapplication development system (ADS) embodiment of the present inventionfor fraud-based target applications;

FIG. 3 is functional block diagram of a model training embodiment of thepresent invention;

FIG. 4 is functional block diagram of a real-time payment fraudmanagement system like that illustrated in FIG. 1 as applied paymentfraud model;

FIG. 5 is functional block diagram of a smart agent process embodimentof the present invention;

FIG. 6 is functional block diagram of a most recent 15-minutetransaction velocity counter; and

FIG. 7 is functional block diagram of a cross-channel payment fraudmanagement embodiment of the present invention.

DETAILED DESCRIPTION OF THE INVENTION

FIG. 1 represents an artificial intelligence fraud management solutionembodiment of the present invention, and is referred to herein by thegeneral reference numeral 100. Such solution 100 comprises an expertprogrammer development system 102 for building trainable general paymentfraud models 104 that integrate several, but otherwise blank artificialintelligence classifiers, e.g., neural networks, case based reasoning,decision trees, genetic algorithms, fuzzy logic, and rules andconstraints. These are further integrated by the expert programmersinputs 106 and development system 102 to include smart agents andassociated real-time profiling, recursive profiles, and long-termprofiles.

The trainable general payment fraud models 104 are trained withsupervised and unsupervised data 108 and 110 to produce a trainedpayment fraud model 112. For example, accountholder and historicaltransaction data. This trained payment fraud model 112 can then be soldas a computer program library or a software-as-a-service applied paymentfraud model. This then is applied by a commercial client in an appliedpayment fraud model 114 to process real-time transactions andauthorization requests 116 for fraud scores. The applied payment fraudmodel 114 is further able to accept a client tuning input 120.

FIG. 2A represents an application development system (ADS) embodiment ofthe present invention for fraud-based target applications, and isreferred to herein by the general reference numeral 200. Such is theequivalent of development system 102 in FIG. 1. ADS 200 comprises anumber of computer program development libraries and tools that highlyskilled artificial intelligence scientists and artisans can manipulateinto a novel combination of complementary technologies. In an earlyembodiment of ADS 200 we combined a goal-oriented multi-agent technology201 for building run-time smart agents, a constraint-S based programmingtool 202, a fuzzy logic tool 203, a library of genetic algorithms 205, asimulation and planning tool 206, a library of business rules andconstraints 207, case-based reasoning and learning tools 208, areal-time interpreted language compiler 209, a C++ code generator 210, alibrary of data compression algorithms 211, and a database connectivitytool 212.

The highly skilled artificial intelligence scientists and artisansprovide graphical and textual inputs 214 and 216 to a user interface (U)218 to manipulate the novel combinations of complementary technologiesinto a declarative application 220.

Declarative application 214 is molded, modeled, simulated, tested,corrected, massaged, and unified into a fully functional hybridcombination that is eventually output as a trainable general paymentfraud model 222. Such is the equivalent of trainable general paymentfraud model 104 in FIG. 1.

It was discovered by the present inventor that the highly skilledartificial intelligence scientists and artisans that could manipulatethe complementary technologies mentioned into specific novelcombinations required exceedingly talented individuals that were inshort supply.

It was, however, possible to build and to prove out that ADS 200 as acompiler would produce trainable general payment fraud models 220, andthese were more commercially attractive and viable.

After many years of experimental use and trials, ADS 200 was constantlyimproved and updated. Database connectivity tool 212, for example, triedto press conventional databases into service during run-time to receiveand supply data points in real-time transaction service. It turned outno conventional databases were up to it.

At the present, an updated and improved ADS shown with general referencenumeral 230 in FIG. 2B is providing better and more useful trainablegeneral payment fraud models.

ADS 230 is the most recent equivalent of development system 102 inFIG. 1. ADS 230 assembles together a different mix of computer programdevelopment libraries and tools for the highly skilled artificialintelligence scientists and artisans to manipulate into a new hybrid ofstill complementary technologies.

In this later embodiment, ADS 230, we combined an improved smart-agenttechnology 231 for building run-time smart agents that are essentiallyonly silhouettes of their constituent attributes. These attributes arethemselves smart-agents with second level attributes and values that areable to “call” on real-time profilers, recursive profilers, and longterm profilers. Such profilers can provide comparative assessments ofeach data point with the new information flowing in during run-time.

The three profilers can thereafter throw exceptions in each data pointcategory, and the number and quality of exceptions thrown across thebreadth of the attributes then incoming will produce a fraud risk scorethat generally raises exponentially with that number of exceptionsthrown. Oracle explains in C++ programming that exceptions provide a wayto react to exceptional circumstances (like fraud suspected) in programsby transferring control to special functions called “handlers”.

At the top level of a hierarchy of smart agents linked by theirattributes are the smart agents for the independent actors who canengage in fraud. In a payment fraud model, that top level will be thecardholders as tracked by the cardholder account numbers reported intransaction data.

These top level smart agents can call on a moving 15-minute window filethat has all the transactions reported to the system in the last15-minutes. Too much activity in 15-minutes by any one actor is causefor further inspection and analysis.

ADS 230 further comprises a constraint-based programming tool 232, afuzzy logic tool 233, a library of advanced neural network algorithms234, a library of genetic algorithms 235, a simulation and planning tool236, a library of business rules and constraints 237, case-basedreasoning and learning tools 238, a data mining tool 239, a text miningtool 240, a statistical tool 241 and a real-time file system 242.

The real-time file system 242 is a simple organization of attributevalues for smart agent profilers that allow quick, direct file access.

The highly skilled artificial intelligence scientists and artisansprovide graphical and textual inputs 244 and 246 to a user interface(UI) 248 to manipulate the novel combinations of complementarytechnologies into a declarative application 250.

Declarative application 250 is also molded, modeled, simulated, tested,corrected, massaged, and unified into a fully functional hybridcombination that is eventually output as a trainable general paymentfraud model 252. Such is also the more improved equivalent of trainablegeneral payment fraud model 104 in FIG. 1.

The constraint-based programming tools 202 and 232 limit the number ofpossible solutions. Complex conditions with complex constraints cancreate an exponential number of possibilities. Fixed constraints, fuzzyconstraints, and polynomials are combined in cases where no exactsolution exists. New constraints can be added or deleted at any time.The dynamic nature of the tool makes possible real-time simulations ofcomplex plans, schedules, and diagnostics.

The constraint-based programming tools are written as a very completelanguage in its own right. It can integrate a variety of variables andconstraints, as in the following Table.

 Variables: Real, with integer values, enumerated, sets, matrices andvectors, intervals, fuzzy subsets, and more.  Arithmetic constraints: =,+, −, *, /, /=, >, <, >=, <=, interval addition, interval subtraction,interval multiplication and interval division, max, min, intersection,union, exponential, modulo, logarithm, and more.  Temporal (Allen)Constraints: Control allows you to write any temporal constraintsincluding Equal, N-equal, Before, After, Meets, Overlaps, Starts,Finishes, and personal temporal operators such as Disjoint, Started-by,Overlapped-by, Met-by, Finished-by, and more.  Boolean Constraints: Or,And, Not, Xor, Implication, Equivalence  Symbolic Constraints:Inclusion, Union, Intersection, Cardinality, Belonging, and more.

The constraint-based programming tools 202 and 232 include a library ofways to arrange subsystems, constraints and variables. Controlstrategies and operators can be defined within or outside usingtraditional languages such as C, C++, FORTRAN, etc. Programmers do nothave to learn a new language, and provides an easy-to-master programminginterface by providing an in-depth library and traditional tools.

Fuzzy logic tools 203 and 233 recognize many of the largest problems inorganizations cannot be solved by simple yes/no or black/white answers.Sometimes the answers need to be rendered in shades of gray. This iswhere fuzzy logic proves useful. Fuzzy logic handles imprecision oruncertainty by attaching various measures of credibility topropositions. Such technology enables clear definitions of problemswhere only imperfect or partial knowledge exists, such as when a goal isapproximate, or between all and nothing. In fraud applications, this canequate to the answer being “maybe” fraud is present, and thecircumstances warrant further investigation.

Tools 204 and 234 provides twelve different neural network algorithms,including Back propagation, Kohonen, Art, Fuzzy ART, RBF and others, inan easy-to-implement C++ library. Neural networks are algorithmicsystems that interpret historical data to identify trends and patternsagainst which to compare subject cases. The libraries of advanced neuralnetwork algorithms can be used to translate databases to neurons withoutuser intervention, and can significantly accelerate the speed ofconvergence over conventional back propagation, and other neural networkalgorithms. The present invention's neural net is incremental andadaptive, allowing the size of the output classes to change dynamically.An expert mode in the advanced application development tool suiteprovides a library of twelve different neural network models for use incustomization.

Neural networks can detect trends and patterns other computer techniquesare unable to. Neurons work collaboratively to solve the definedproblem. Neural networks are adept in areas that resemble humanreasoning, making them well suited to solve problems that involvepattern recognition and forecasting. Thus, neural networks can solveproblems that are too complex to solve with conventional technologies.

Libraries 205 and 235 include genetic algorithms to initialize apopulation of elements where each element represents one possible set ofinitial attributes. Once the models are designed based on theseelements, a blind test performance is used as the evaluation function.The genetic algorithm will be then used to select the attributes thatwill be used in the design of the final models. The componentparticularly helps when multiple outcomes may achieve the samepredefined goal. For instance, if a problem can be solved profitably inany number of ways, genetic algorithms can determine the most profitableway.

Simulation and planning tool 206 can be used during model designs tocheck the performances of the models.

Business rules and constraints 207 provides a central storage of bestpractices and know how that can be applied to current situations. Rulesand constraints can continue to be captured over the course of years,applying them to the resolution of current problems.

Case-based reasoning 208 uses past experiences in solving similarproblems to solve new problems. Each case is a history outlined by itsdescriptors and the steps that lead to a particular outcome. Previouscases and outcomes are stored and organized in a database. When asimilar situation presents itself again later, a number of solutionsthat can be tried, or should be avoided, will present immediately.Solutions to complex problems can avoid delays in calculations andprocessing, and be offered very quickly.

Language interpretation tool 209 provides a constant feedback andevaluation loop. Intermediary Code generator 210 translates DeclarativeApplications 214 designed by any expert into a faster program 230 for atarget host 232.

During run-time, real time transaction data 234 can be received andprocessed according to declarative application 214 by target host 232with the objective of producing run-time fraud detections 236. Forexample, in a payments application card payments transaction requestsfrom merchants can be analyzed for fraud activity. In healthcareapplications the reports and compensation demands of providers can bescanned for fraud. And in insider trader applications individual traderscan be scrutinized for special knowledge that could have illegallyhelped them profit from stock market moves.

File compression algorithms library 211 helps preserve network bandwidthby compressing data at the user's discretion.

FIG. 3 represents a model training embodiment of the present invention,and is referred to herein by the general reference numeral 300. Modeltrainer 300 can be fed a very complete, comprehensive transactionhistory 302 that can include both supervised and unsupervised data. Afilter 304 actually comprises many individual filters that can beselected by a switch 306. Each filter can separate the supervised andunsupervised data from comprehensive transaction history 302 into astream correlated by some factor in each transaction.

The resulting filtered training data will produce a trained model thatwill be highly specific and sensitive to fraud in the filtered category.When two or more of these specialized trained models used in parallelare combined in other embodiments of the present invention they willexcel in real-time cross-channel fraud prevention.

In a payment card fraud embodiment of the present invention, the filters304 are selected by switch 306 to filter through card-not-presenttransactions, card-present transactions, international transactions,domestic transactions, debit card transactions, credit cardtransactions, contactless transactions, or other groupings or financialnetworks.

A data cleanup process 308 is used to harmonize, unify, error-correct,and otherwise standardize the data coming from transaction data history302. The commercial advantage of that is clients can provide theirtransaction data histories 302 in whatever formats and file structuresare natural to the provider.

A data enrichment process 310 computes interpolations and extrapolationsof the data and produces as many as two-hundred and fifty data pointsfrom the forty or so relevant data points originally provided bytransaction data history 302.

A trainable fraud model 312, like that illustrated in FIG. 1 astrainable general payment fraud model 104, is trained. Such can beimported as a purchased commercial product or library.

A selected applied fraud model 314, like that illustrated in FIG. 1 asapplied fraud model 114, results from the selected training that resultsfrom the switch 306 setting and the filters 304. A variety of selectedapplied fraud models 316-323 represent the applied fraud models 114 thatresult with different settings of filter switch 306. Each selectedapplied fraud model 314 will include a hybrid of artificial intelligenceclassification models represented by models 330-332 and a smart-agentpopulation build 334 with a corresponding set of real-time, recursive,and long-term profilers 336. The enriched data from data enrichmentprocess 310 is fully represented in the smart-agent population build 334and profilers 336.

FIG. 4 represents a real-time payment fraud management system 400 likethat illustrated in FIG. 1 as applied payment fraud model 114. A rawtransaction separator 402 filters through the forty or so data itemsthat are relevant to the computing of a fraud score. A process 404 addstimestamps to these relevant data points and passes them in parallel toa selected applied fraud model 406. This is equivalent to a selected oneof applied fraud models 316-323 in FIG. 3 and applied payment fraudmodel 114 in FIG. 1.

During a session in which the time-stamped relevant transaction dataflows in, a set of classification models 408-410 operate independentlyaccording to their respective natures. A population of smart agents 412and profilers 414 also operate on the time-stamped relevant transactiondata inflows. Each new line of time-stamped relevant transaction datawill trigger an update 416 of the respective profilers 414. Theirattributes 418 are provided to the population of smart agents 412.

The classification models 408-410 and population of smart agents 412 andprofilers 414 all each produce an independent and separate vote or fraudscore 420-423 on the same line of time-stamped relevant transactiondata. A weighted summation processor 424 responds to client tunings 426to output a final fraud score 428.

FIG. 5 represents a smart agent process 500 in an embodiment of thepresent invention. For example, these would include the smart agentpopulation build 334 and profiles 336 in FIG. 3 and smart agents 412 andprofiles 414 in FIG. 4. A series of payment card transactions arrivingin real-time in an authorization request message is represented here bya random instantaneous incoming real-time transaction record 502.

Such record 502 begins with an account number 504. It includesattributes A1-A9 numbered 505-513 here. These attributes, in the contextof a payment card fraud application would include data points for cardtype, transaction type, merchant name, merchant category code (MCC),transaction amount, time of transaction, time of processing, etc.

Account number 504 in record 502 will issue a trigger 516 to acorresponding smart agent 520 to present itself for action. Smart agent520 is simply a constitution of its attributes, again A1-A9 and numbered521-529 in FIG. 5. These attributes A1-A9 521-529 are merely pointers toattribute smart agents. Two of these, one for A1 and one for A2, arerepresented in FIG. 5. Here, an A1 smart agent 530 and an A2 smart agent540. These are respectively called into action by triggers 532 and 542.

A1 smart agent 530 and A2 smart agent 540 will respectively fetchcorrespondent attributes 505 and 506 from incoming real-time transactionrecord 502. Smart agents for A3-A9 make similar fetches to themselves inparallel. They are not shown here to reduce the clutter for FIG. 5 thatwould otherwise result.

Each attribute smart agent like 530 and 540 will include or access acorresponding profile data point 536 and 546. This is actually asimplification of the three kinds of profiles 336 (FIG. 3) that wereoriginally built during training and updated in update 416 (FIG. 4).These profiles are used to track what is “normal” behavior for theparticular account number for the particular single attribute.

For example, if one of the attributes reports the MCC's of the merchantsand another reports the transaction amounts, then if the long-term,recursive, and real time profiles for a particular account number xshows a pattern of purchases at the local Home Depot and Costco thataverage $100-$300, then an instantaneous incoming real-time transactionrecord 502 that reports another $200 purchase at the local Costco willraise no alarms. But a sudden, unique, inexplicable purchase for $1250at a New York Jeweler will and should throw more than one exception.

Each attribute smart agent like 530 and 540 will further include acomparator 537 and 547 that will be able to compare the correspondingattribute in the instantaneous incoming real-time transaction record 502for account number x with the same attributes held by the profiles forthe same account. Comparators 537 and 547 should accept some slack, butnot too much. Each can throw an exception 538 and 548, as can thecomparators in all the other attribute smart agents. It may be usefulfor the exceptions to be a fuzzy value, e.g., an analog signal 0.0 to1.0. Or it could be a simple binary one or zero. What sort of excursionsshould trigger an exception is preferably adjustable, for example withclient tunings 426 in FIG. 4.

These exceptions are collected by a smart agent risk algorithm 550. Onedeviation or exception thrown on any one attribute being “abnormal” canbe tolerated if not too egregious. But two or more should be weightedmore than just the simple sum, e.g., (1+1)n=2n instead of simply 1+1=2.The product is output as a smart agent risk assessment 552. This outputis the equivalent of independent and separate vote or fraud score 423 inFIG. 4.

FIG. 6 represents a most recent 15-minute transaction velocity counter600, in an embodiment of the present invention. It receives the samekind of real-time transaction data inputs as were described inconnection with FIG. 4 as raw transaction data 402 and FIG. 5 as records502. A raw transaction record 602 includes a hundred or so data points.About forty of those data points are relevant to fraud detection anidentified in FIG. 6 as reported transaction data 604.

The reported transaction data 604 arrive in a time series and randomlyinvolve a variety of active account numbers. But, let's say the mostcurrent reported transaction data 604 with a time age of 0:00 concerns aparticular account number x. That fills a register 606.

Earlier arriving reported transaction data 604 build a transactiontime-series stack 608. FIG. 6 arbitrarily identifies the respective agesof members of transaction time-series stack 608 with example ages 0:73,1:16, 3:11, 6:17, 10:52, 11:05, 13:41, and 14:58. Those aged more than15-minutes are simply identified with ages “>15:00”. This embodiment ofthe present invention is concerned with only the last 15-minutes worthof transactions. As time passes transaction time-series stack 608 pushesdown.

The key concern is whether account number x has been involved in anyother transactions in the last 15-minutes. A search process 610 acceptsa search key from register 606 and reports any matches in the most15-minute window with an account activity velocity counter 612. Too muchvery recent activity can hint there is a fraudster at work, or it may benormal behavior. A trigger 614 is issued that can be fed to anadditional attribute smart agent that is included with attributes smartagents 530 and 540 and the others in parallel. Exception from this newaccount activity velocity counter smart agent is input to smart agentrisk algorithm 550 in FIG. 5.

FIG. 7 represents a cross-channel payment fraud management embodiment ofthe present invention, and is referred to herein by general referencenumeral 700.

Real-time multi-channel monitoring uses track cross channel and crossproduct patterns to cross pollinate information for more accuratedecisions. Such track not only the channel where the fraud ends but alsothe initiating channel to deliver a holistic fraud monitoring. Astandalone internet banking fraud solution will allow a transaction ifit is within its limits, however if core banking is in picture, then itwill stop this transaction, as we additionally know the source offunding of this account (which mostly in missing in internet banking).

In FIG. 3, a variety of selected applied fraud models 316-323 representthe applied fraud models 114 that result with different settings offilter switch 306. A real-time multi-channel monitoring payment networkserver can be constructed by running several of these selected appliedfraud models 316-323 in parallel.

FIG. 7 represents a real-time multi-channel monitoring payment networkserver 700, in an embodiment of the present invention. Raw incomingtransaction data is selectively filtered for relevancy by a process 702.The resulting relevant data is time-stamped in a process 704. A bus 706feeds the same such data in parallel line-by-line, e.g., to a selectedapplied fraud model for card present 708, a selected applied fraud modelfor domestic 709, a selected applied fraud model for credit 710, aselected applied fraud model for contactless 711, and a selected appliedfraud model for jewelry 712. In other words, this example array in FIG.7 will very tightly analyze domestic contactless credit cardtransactions that are card-present in a jewelry purchase.

Each selected applied fraud model 708-712 provides exceptions 718-722 tothe instant transactions on bus 706 that a weighted summation process724 can balance according to a client tuning 726. A result 728 can beexpected to be highly accurate with low false positives.

In general, embodiments of the present invention are adaptive. Adaptivelearning combines three learning techniques. First is the automaticcreation of profiles, or smart-agents, from historical data, e.g.,long-term profiling. The second is real-time learning, e.g., enrichmentof the smart-agents based on real-time activities. The third is adaptivelearning carried by incremental learning algorithms.

For example, two years of historical credit card transactions dataneeded over twenty seven terabytes of database storage. A smart-agent iscreated for each individual card in that data in a first learning step,e.g., long-term profiling. Each profile is created from the card'sactivities and transactions that took place over the two year period.Each profile for each smart-agent comprises knowledge extractedfield-by-field, such as merchant category code (MCC), time, amount foran mcc over a period of time, recursive profiling, zip codes, type ofmerchant, monthly aggregation, activity during the week, weekend,holidays, Card not present (CNP) versus card present (CP), domesticversus cross-border, etc. this profile will highlights all the normalactivities of the smart-agent (specific card).

Smart-agent technology has been observed to outperform conventionalartificial and machine learning technologies. For example, data miningtechnology creates a decision tree from historical data. When historicaldata is applied to data mining algorithms, the result is a decisiontree. Decision tree logic can be used to detect fraud in credit cardtransactions. But, there are limits to data mining technology. The firstis datamining can only learn from historical data and it generatesdecision tree logic that applies to all the cardholders as a group. Thesame logic is applied to all cardholders even though each merchant mayhave a unique activity pattern and each cardholder may have a uniquespending pattern.

A second limitation is decision trees become immediately outdated. Fraudschemes continue to evolve, but the decision tree was fixed withexamples that do not contain new fraud schemes. So stagnant non-adaptingdecision trees will fail to detect new types of fraud, and do not havethe ability to respond to the highly volatile nature of fraud.

Another technology widely used is “business rules” which require expertto writes rules, e.g., if-then-else logic. The most importantlimitations are that business rules require writing rules that aresupposed to work for whole categories of customers. This requires thepopulation to be sliced into many categories (students, seniors, zipcodes, etc.) and ask experts to think about rules that will be appliedto all the cardholders of the category. How could the US population besliced? Even worse, why would all the cardholders in a category all havethe same behavior? It is obvious that business rules has limits, andpoor detection rates with high false positives. What should also beobvious is the rules are outdated as soon as they are written becausethey don't adapt at all to new fraud schemes or data shifts.

Neural network technology also limits, it uses historical data to createa matrix weights for future data classification. The Neural network willuse as input (first layer) the historical transactions and theclassification for fraud or not as an output). Neural Networks onlylearn from past transactions and cannot detect any new fraud schemes(that arise daily) if the neural network was not re-trained with thistype of fraud. Same as datamining and business rules the classificationlogic learned from the historical data will be applied to all thecardholders even though each merchant has a unique activity pattern andeach cardholder has a unique spending pattern.

Another limit is the classification logic learned from historical datadecision trees is outdated the same day of its use because the fraudschemes changes but since the neural network did learn with examplesthat contains this new type of fraud schemes, it will fail to detectthis new type of fraud it lacks the ability to adapt to new fraudschemes and do not have the ability to respond to the highly volatilenature of fraud.

Contrary to previous technologies, smart-agent technology learns thespecific behaviors of each cardholder and create a smart-agent thatfollow the behavior of each cardholder. Because it learns from eachactivity of a cardholder, the smart-agent updates the profiles and makeseffective changes at runtime. It is the only technology with an abilityto identify and stop, in real-time, previously unknown fraud schemes. Ithas the highest detection rate and lowest false positives because itseparately follows and learns the behaviors of each cardholder.

Smart-agents have a further advantage in data size reduction. Once, saytwenty-seven terabytes of historical data is transformed intosmart-agents, only 200-gigabytes is needed to represent twenty-sevenmillion distinct smart-agents corresponding to all the distinctcardholders.

Incremental learning technologies are embedded in the machine algorithmsand smart-agent technology to continually re-train from any falsepositives and negatives that occur along the way. Each corrects itselfto avoid repeating the same classification errors. Data mining logicincrementally changes the decision trees by creating a new link orupdating the existing links and weights. Neural networks update theweight matrix, and case based reasoning logic updates generic cases orcreates new ones. Smart-agents update their profiles by adjusting thenormal/abnormal thresholds, or by creating exceptions.

Although particular embodiments of the present invention have beendescribed and illustrated, such is not intended to limit the invention.Modifications and changes will no doubt become apparent to those skilledin the art, and it is intended that the invention only be limited by thescope of the appended claims.

We claim:
 1. A computer-implemented method for detecting payment fraud,comprising: executing, at a computing device, a computer programincluding a classification model and a plurality of smart agentsrespectively corresponding to a plurality of transactional entities,each smart agent having a profile comprising a representation ofhistorical data of the corresponding transactional entity and includinglong-term and real-time profiles with the real-time profile excludinghistorical data aged beyond a pre-determined time period, and theclassification model being constructed according to one or more of: datamining logic, a neural network, case-based-reasoning, clustering, fuzzylogic, a genetic algorithm, a decision tree, and business rules;inputting, via the computing device, transactional data to the program,the transactional data including transaction records reflectingtransactions of the plurality of transactional entities, the programbeing configured to perform the following steps for each of thetransaction records— compare the contents of at least one data field ofthe transaction record against the corresponding long-term profile andreal-time profile to generate a first output based on a comparisonresult, the first output including an exception if the comparison resultexceeds a corresponding threshold, process the contents of at least onedata field of the transaction record via the classification model togenerate a second output, analyze the first output and the second outputto generate a fraud score, including by adjusting the fraud score basedon any generated exceptions, wherein the program is further configuredto— receive feedback relating to accuracy of the fraud score, re-trainthe classification model based on the feedback, update the long-term andreal-time profiles based on the feedback, process future transactionrecords using the re-trained classification model and the updatedlong-term and real-time profiles.
 2. The computer-implemented method ofclaim 1, wherein the analysis of the first and the second output foreach of the transaction records includes determining a weightedsummation.
 3. The computer-implemented method of claim 2, whereinanalyzing the first output and the second output using the weightedsummation includes retrieving one or more client tuning inputs andincorporating the one or more client tuning inputs into the weightedsummation.
 4. The computer-implemented method of claim 2, wherein theprofile of the corresponding smart agent includes a recursive profile.5. The computer-implemented method of claim 4, wherein— the programcompares a plurality of data fields of the transaction record againstthe recursive profile, an exception is generated for each recursivecomparison result exceeding a corresponding threshold, the weightedsummation is configured to adjust the fraud score based on any generatedrecursive exceptions.
 6. The computer-implemented method of claim 1,wherein the classification model comprises data mining logic and there-training comprises making an incremental change to a decision tree.7. The computer-implemented method of claim 1, wherein theclassification model comprises a neural network and the re-trainingcomprises updating a weight matrix of the neural network.
 8. Thecomputer-implemented method of claim 1, wherein the program is furtherconfigured to update the profile of the corresponding smart agent toreflect contents of at least one data field of the transaction record.9. The computer-implemented method of claim 1, wherein comparing thecontents of the at least one data field of the transaction recordagainst the real-time profile for each of the transaction recordsincludes— determining whether revising the real-time profile to reflectthe transaction record exceeds a threshold for transactions associatedwith the corresponding transactional entity within the pre-determinedtime period.
 10. The computer-implemented method of claim 1, wherein—the profile of the corresponding smart agent corresponds to a firsttransactional channel and to a first transactional entity of theplurality of transactional entities, the program is further configuredto— compare the contents of at least one data field of a secondtransaction record against a second profile corresponding to the firsttransactional entity and a second transactional channel to generate athird output, process the contents of at least one data field of thesecond transaction record via a second classification model to generatea fourth output, analyze the third output and the fourth output togenerate a second fraud score, adjust the profile in response to atleast one of the third output, the fourth output and the second fraudscore, adjust the second profile in response to at least one of thefirst output, the second output and the fraud score.
 11. A computerprogram comprising instructions to perform the following steps, whenexecuted by one or more processors: compare contents of at least onedata field of a transaction record against a corresponding profile of asmart agent, the profile including long-term and real-time profiles andcomprising a representation of historical data of a correspondingtransactional entity, with the real-time profile excluding historicaldata aged beyond a pre-determined time period; generate a first outputbased on a result of the comparison, the first output including anexception if the comparison result exceeds a corresponding threshold,process the contents of at least one data field of the transactionrecord via a classification model to generate a second output, theclassification model being constructed according to one or more of: datamining logic, a neural network, case-based-reasoning, clustering, fuzzylogic, a genetic algorithm, a decision tree, and business rules; analyzethe first output and the second output to generate a fraud score,including by adjusting the fraud score based on any generatedexceptions; receive feedback relating to accuracy of the fraud score;re-train the classification model based on the feedback; and update thelong-term and real-time profiles based on the feedback, wherein thecomputer program is configured to process future transaction recordsusing the re-trained classification model and the updated long-term andreal-time profiles.
 12. The computer program of claim 11, wherein theanalysis of the first and the second output for the transaction recordincludes determining a weighted summation.
 13. The computer program ofclaim 12, wherein analyzing the first output and the second output usingthe weighted summation includes retrieving one or more client tuninginputs and incorporating the one or more client tuning inputs into theweighted summation.
 14. The computer program of claim 12, wherein theprofile of the smart agent includes a recursive profile.
 15. Thecomputer program of claim 14, wherein— the program compares a pluralityof data fields of the transaction record against the recursive profile,an exception is generated for each recursive comparison result exceedinga corresponding threshold, the weighted summation is configured toadjust the fraud score based on any generated recursive exceptions. 16.The computer program of claim 11, wherein the classification modelcomprises data mining logic and the re-training comprises making anincremental change to a decision tree.
 17. The computer program of claim11, wherein the classification model comprises a neural network and there-training comprises updating a weight matrix of the neural network.18. The computer program of claim 11, wherein the program is furtherconfigured to, when executed by the one or more processors, update theprofile of the smart agent to reflect contents of at least one datafield of the transaction record.
 19. The computer program of claim 11,wherein comparing the contents of the at least one data field of thetransaction record against the real-time profile for each of thetransaction records includes— determining whether revising the real-timeprofile to reflect the transaction record exceeds a threshold fortransactions associated with the transactional entity within thepre-determined time period.
 20. The computer program of claim 11,wherein— the profile of the smart agent corresponds to a firsttransactional channel, the program is further configured to, whenexecuted by the one or more processors— compare the contents of at leastone data field of a second transaction record against a second profilecorresponding to the transactional entity and a second transactionalchannel to generate a third output, process the contents of at least onedata field of the second transaction record via a second classificationmodel to generate a fourth output, analyze the third output and thefourth output to generate a second fraud score, adjust the profile inresponse to at least one of the third output, the fourth output and thesecond fraud score, adjust the second profile in response to at leastone of the first output, the second output and the fraud score.